Ransomware victims may be penalized for paying up, says Treasury

Victims of ransomware attacks who pay criminals to release their data may be held liable for violating U.S. sanctions — even if they don’t know the true identity of their tormentors, advised the Treasury Department in a bulletin last week.

Why it matters: The move could doubly punish the victims of ransomware attacks.

Between the lines: The cyber criminals responsible for major ransomware attacks do not often volunteer their true identities to their victims, and the payment schemes are generally conducted anonymously using cryptocurrency.

• It’s not just victims who might be subject to civil penalties for paying sanctioned ransomware attackers, says the Treasury, but also “those involved in providing cyber insurance, digital forensics and incident response, and financial services that may involve processing ransom payments.”

Background: The Treasury, through its Office of Foreign Assets Control, sanctions entities and individuals deemed national security threats — including state-linked hackers, terrorists and even transnational cyber criminal groups. Under these sanctions, U.S. persons or businesses are totally forbidden from facilitating or carrying out any financial exchange with these entities.

• Some of these sanctioned groups, like the Russian cyber criminal syndicate Evil Corp, act generally on their own behalf and are motivated by private profit.
• But other sanctioned entities, like the Lazarus Group, which is directly connected with North Korean intelligence, use ransomware attacks to pad the coffers of foreign governments.

By the numbers: Reports of ransomware attacks increased 37% from 2018 to 2019, according to the FBI, with a 147% spike in “associated losses” during that period, per the Treasury bulletin.

Go deeper: 🎧 Axios Re:Cap podcast: American health care held for ransom (listen here)